feat: /v1/role list, get, create, update and delete. Reassign members on delete. Write-time validation (ValidateGrants, duplicates, typed keys against real content types). Name uniqueness (role_name_taken), role_locked, role_has_members, role_conflict on version mismatch. No-escalation: nobody grants a permission they don't hold, and roles.edit_owner_only guards the Owner role. Activity events for role changes. Typed-key exposure in /auth/me. Cleanup of typed rows when a content type is deleted. | Backend only. Will carry the deferred ListGrants decision.

internal/infrastructure/persistence/models/roleModel.go

@@ -1,12 +1,16 @@
 package models
 
+import "time"
+
 type Role struct {
-	ID          uint32 `gorm:"primaryKey;autoIncrement"`
-	Name        string `gorm:"not null;size:100;index"`
-	Description string `gorm:"not null;default:'';size:255"`
-	BuiltIn     bool   `gorm:"not null;default:false"`
-	Locked      bool   `gorm:"not null;default:false"`
-	Version     uint32 `gorm:"not null;default:1"`
+	ID          uint32     `gorm:"primaryKey;autoIncrement"`
+	Name        string     `gorm:"not null;size:100;index"`
+	Description string     `gorm:"not null;default:'';size:255"`
+	BuiltIn     bool       `gorm:"not null;default:false"`
+	Locked      bool       `gorm:"not null;default:false"`
+	Version     uint32     `gorm:"not null;default:1"`
+	EditedAt    *time.Time `gorm:"column:updated_at"`
+	EditedBy    *uint32    `gorm:"column:updated_by"`
 }
 
 type RolePermission struct {